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Amendments to the Claims : 

This listing of the claims will replace all prior versions, and listings, of claims in 

the application: 

Listing of Claims: 
1-46 (Cancelled). 

47 (Currently Amended). A method fef-of collecting information relating to a 
communication networ k and to substantially all nodes operating in said communication network , 
the method comprising: 

detecting , substantially in real-time, data conveyed by one or more detected nodes 
operating in the communication network in a manner that is transparent to said one or more 
detected nodes, giving rise to the detected nedes data. thereby detecting said data passively : 
analyzing said detected data for identifying! 

nodal information relating to the one or more detected nodes and for 
identifying missing information; and querying one or more queried nodes for the missing 

nodal information relating to said communication network; 

missing information regarding at least one of said one or more detected 

nodes; and 

missing information regarding said communication network; and 
storing at least a part of the identified information on a storage device comprising 
a computer readable medium accessible thereto; 
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querying at least one of one or more nodes operating in said communication 
network for said missing information provided at least partially from said storage device, giving 
rise to the queried nodes, thereby collecting said missing information actively. 

48 (Currently Amended). The method of Claim 47 . wherein , further 

comprising : 

there ore received othe r receiving additional data relating to the communication 

network; and 

and the analyzing detected date analyzes also the othe r said additional data for 
identifying the missing information. 

49 (Currently Amended). The method of Claim 47, wherein the nodal 
information includes comprises operating system information relating to operating systems 
operating on the one or more nodes. 

50 (Previously Presented). The method of Claim 49, wherein the nodes are 
included in at least one of the following: detected nodes and queried nodes. 

51 (Currently Amended). The method of Claim 49, wherein detecting the 
detection of the dat a includes comprises detecting at least one type of message from a group 
including comprising DHCP (Dynamic Host Configuration Protocol) messages and SYN 
packets. 
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52 (Currently Amended). The method of Claim 49, wherein the analyzing 
includes further comprises : 

receiving data corresponding to data conveyed by a detected node , giving rise to 
the received data : 

inspecting said r eceived data for one or more characteristics of a known operating 

system; and 

if inspecting of said received data r eveals that the data conforms with the with 
said one or more characteristics, indicating that the known operating system operates on the 
detected node. 

53 (Currently Amended). The method of Claim 47, wherein the nodal 
information includes comprises runtime information relating to running processes. 

54 (Currently Amended). The method of Claim 53, wherein the runtime 
information relating to running processes include comprises at least one from one of the 
following: information relating to network running processes operating on the detected nodes; 
and information relating to local running processes operating on the detected nodes. 

55 (Currently Amended). The method of Claim 47, wherein the nodal 
information includes comprises hardware information relating to hardware components 
associated with the respective detected nodes. 
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56 (Currently Amended). The method of Claim 47, wherein the nodal 
information includes comprises topology information relating to physical topology of the 
communication network. 



57 (Currently Amended). The method of Claim 47, wherein the querying 
includes: further comprises: 

generating a query message corresponding to the missing information fo r sending 
conveying said query message to one or more nodes to be queried nodes. : 

conveying the query message to said one or more nodes, giving rise to the queried 

nodes. 



58 (Currently Amended). The method of Claim 57, wherein the querying 

furthe r includes comprises : 

receiving at least one response that corresponds to the query message; and 
processing the at least one response to retrieve information corresponding to the 

missing information. 



59 (Currently Amended). The method of Claim 57, wherein the query 
message is one of the following: an ARP (Address Resolution Protocol) request, request: an 
ICMP (Internet Control Message Protocol) echo request; and a TCP-SYN request. 
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60 (Currently Amended). The method of Claim 57, wherein the g enerating is 
done in accordance with a test policy^ and 

wherein the test policy is selected from a group of available test policies. 

61 (Currently Amended). The method of Claim 57, wherein the generating is 
done in accordance with a test policy^ and 

wherein the test policy is selected in accordance with a statistical computation. 

62 (Previously Presented). The method of Claim 57, wherein said missing 
information relates to at least one running process operating on respective queried nodes. 

63 (Currently Amended). The method of Claim 57, wherein the detected 
nodes include comprises at4eas e least one queried node^ an d the date the data conveyed by 
detected nodes includes at least on at least one response that corresponds to the query message. 



configured to collect information relating to a communication networ k and to substantially all 
nodes operating in said communication network , the-^syste m network information collector 

comprising: 



data conveyed by one or more detected nodes operating in the communication network in a 
manner that is transparent to the one or more detected nodes ;an analyzer for analyzing detected 



64 (Currently Amended). A network information coUector- 




a network detecto r for detectin g configured to detect, substantially in real-time. 
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data for identifying nodal information relating , giving rise to the detected nodes and for 
identifying missing information; an d data, thereby detecting said data passively; 

a query engine for querying one or more nodes queried nodes for the missing 

information. 

an analyzer configured to analyze said detected data for identifying: 
nodal information relating to said one or more detected nodes; 
nodal information relating to said communication network; 
missing information regarding at least one of said one or more detected 

nodes; and 

missing information regarding said communication network; and 
a query engine configure to query at least one of one or more nodes operating in 
said communication network for said missing information, giving rise to the queried nodes, 
thereby collecting said missing information actively. 



65 (Currently Amended). The network information collector of Claim 64, 
further including; comprising: 

an input device for receiving othe r configured to receive additional data relating to 
the communication networkt-and^ 

wherein the analyzer is configured to analyze also said additional data for 
identifying the other data for identifying the missing information. 
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66 (Currently Amended). The network information collector of Claim 64, 
wherein the analyzer is configured to analyze nodal information that includes operating system 
information relating to operating systems operating on the one or more detected nodes. 

67 (Currently Amended). The network information collector of Claim 66, 
wherein detecting the detection of the data conveyed by the one or more detected nodes includes 
comprises detecting at least one type of message from a group includin g comprising DHCP 
(Dynamic Host Configuration Protocol) messages; and SYN packets. 

68 (Currently Amended). The network the network information collector of 
Claim 66, wherein the analyze r includes further comprises : 

an input for receivin g device configured to receive data, fe egiving rise to the 
detected data, said received data corresponds to data conveyed by a detected node; 

a data inspector coupled to said input device, the data inspector being configured 
to inspect said r eceived data for one or more characteristics of a known operating system; and 

a data marker coupled to said data inspector and being responsive thereto, the data 
marker being configured to indicate that the known operating system ooperates operates on the 
detected node. 

69 (Currently Amended). The network information collector of Claim 64, 
wherein the analyzer is configured to analyze nodal information tha t includes comprises runtime 
information relating to running processes. 
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70 (Currently Amended). The network information collector of Claim 64, 
wherein the query engine includes: 

a query message generato r for generatin g configured to generate a query message 
corresponding to the missing information for conveying said query message to nodes to be 
queried : and 

an output device for conveying configured to convey the query message to the 
nodes to be querie d, giving rise to the queried nodes. 

71 (Currently Amended). The network information collector of Claim 70, 
wherein the query engine further includes: 

an input device for receivin g configured to receive at least one response that 
corresponds to the query message; and 

a response processor for processing the configured to process said at least one 
response to retrieve information corresponding to the missing information. 

72 (Currently Amended). A program storage device readable by machine, 

tangibly embodying a program of instructions executable by the machine to perform method for 
method of collecting information relating to a communication network and to substantially all 
nodes operating in said communication network, the method comprising: 
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detecting , substantially in real-time, data conveyed by one or more detected nodes 
operating in the communication network in a manner that is transparent to said one or more 
detected nodes, giving rise to the detected-^tede s data, thereby detecting said data passively ; 

analyzing said detected data for identifying nodal information relating to the 
detected nodes and for identifying missing information; and : 

querying one or more queried nodes for the missing information- 
nodal information relating to said one or more detected nodes; 
nodal information relating to said communication network; 
missing information regarding at least one of said one or more detected 

nodes; and 

missing information regarding said communication network; and 
querying at least one of one or more nodes operating in said communication 
network for said missing information, giving rise to the queried nodes, thereby collecting said 
missing information actively. 

73 (Currently Amended). A computer program product comprising a 
computer useable medium having computer readable program code embodied therein for 

collecting information relating to a communication network and to substantially all nodes 
operating in said communication network , the computer program product comprising: 

computer readable program code for causing the computer to detec t, substantially 
in real-time, data conveyed by one or more detected nodes operating in the communication 
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network in a manner that is transparent to said one or more detected nodes, giving rise to the 
detected-iiede s data, thereby detecting said data passively ; 

computer readable program code for causing the computer to analyze said 

missing information; and : 

nodal information relating to said one or more detected nodes; 

nodal information relating to said communication network; 

missing information regarding at least one of said one or more detected 

nodes; and 

missing information regarding said communication network; and 
computer readable program code for causing the computer to query at least one of 
one or more queried nodes nodes operating in said communication network for the missing 
information , giving rise to the queried nodes, thereby collecting said missing information 
actively . 
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